Intel® SCS Add-on 2.1 and SC2012 R2 ConfigMgr Integration (RCS Database mode) - Part 6

Article
05/26/2015

Intel AMT Deployment

This part will cover the procedure to provision Intel AMT computers. As a prerequisite, we strongly recommend executing the following 3 tasks on each client computer. To obtain these modules, please contact vendor of client computers.

Update BIOS
Intel Management Engine Interface (Intel MEI) installation
Local Manageability Service (LMS.exe) installation

For more details about prerequisites, please refer to the section 2.2 Supported Intel AMT Versions of Intel(R)_SCS_User_Guide.pdf document included in the Intel SCS for Microsoft System Center Configuration Manager package.

Firewall configuration

1. On the client computer, run the “Windows Firewall wit Advanced Security] console. In the [Inbound Rules], create a [New Rule].
2. Select [Port] and click on [Next].
3. Select [TCP], select [Specific local ports] and type “16993” and “16995”. Click [Next]

4. Select [Allow the connection] and click [Next]
5. Put a check on [Domain], [Private] and [Public] and click [Next]
6. Type a name for the new rule and click [Finish]

Adding Enterprise Root CA certificate thumbprint into AMT computers

≪Warning≫
If using a public certificate, this section can be skipped.

1. Select the Enterprise CA Root certificate and open properties.
2. From the [Details] tab, select [Thumbprint] and note the thumbprint.

3. Turn on an Intel AMT computer and press <Ctrl+P> during boot to trigger the Intel ME interface. Default password is “Admin”.

※the way to access to Intel ME console might be different on some computer hardware.
4. Select [Intel AMT Configuration]

5. Select [Remote Setup And Configuration]

6. Select [TLS PKI]

7. Select [Manage Hashes] then to add a new entry, type the <ins> key.

8. Enter hash name ”Contoso Root CA”

9. To the question [SHA1?], type “Y”.

10. Type the hash we got on step 2

11. Set the newly added hash in “Active” status and leave Intel MBEx saving changes.

Enable Intel SCS Platform Discover task sequence

1. From [Software Library]-[Overview]-[Operating Systems]-[Task Sequence], right-click on [Intel SCS: Platform Discovery] task sequence and [Enable] it.

2. Click [OK] on the dialog box.
3. On the client computer, run [Start]-[All Programs]-[Microsoft System Center 2012 R2]-[Configuration Manager]-[Software Center]. Verify that [Intel SCS: Platform Discovery] task sequence has ended successfully.

4. From [Assets and Compliance]-[Overview]-[Device Collections], right-click on [Intel AMT: Exists] and click on [Update membership].

5. Click [OK] to the warning dialog box.
6. Verify that membership of [Intel AMT: Exists] collection has been updated.

Enable Intel AMT Discovery and Report task sequence

1. From [Software Library]-[Overview]-[Operating Systems]-[Task Sequence], right-click on [Intel AMT: Discovery and Report] task sequence and [Enable] it.

2. Click [OK] on the dialog box.
3. On the client computer, run [Start]-[All Programs]-[Microsoft System Center 2012 R2]-[Configuration Manager]-[Software Center]. Verify that [Intel AMT: Discovery and Report] task sequence has ended successfully.

4. From [Assets and Compliance]-[Overview]-[Device Collections], right-click on [Intel AMT: Not Configured] and click on [Update membership].

5. Click [OK] to the warning dialog box.
6. Verify that membership of [Intel AMT: Not Configured] collection has been updated.

Enable Intel AMT Remote Configuration task sequence

1. From [Software Library]-[Overview]-[Operating Systems]-[Task Sequence], right-click on [Intel AMT: Remote Configuration] task sequence and [Enable] it.

2. Click [OK] on the dialog box.
3. On the client computer, run [Start]-[All Programs]-[Microsoft System Center 2012 R2]-[Configuration Manager]-[Software Center]. Verify that [Intel AMT: Remote Configuration] task sequence has ended successfully.

4. From [Assets and Compliance]-[Overview]-[Device Collections], right-click on [Intel AMT: Configured] and click on [Update membership].

5. Click [OK] to the warning dialog box.
6. Verify that membership of [Intel AMT: Configured] collection has been updated.

Enable Intel AMT Remote Maintenance task sequence

1. From [Software Library]-[Overview]-[Operating Systems]-[Task Sequence], right-click on [Intel AMT: Remote Maintenance] task sequence and [Enable] it.

2. Click [OK] on the dialog box.

AMT Status discovery

1. From [Assets and Compliance]-[Overview]-[Device Collections], double-click on [Intel AMT: Configured] collection. From the computer list, right-click on a computer and click on [Manage Out of Band]-[Discover AMT Status].

2. Click [OK] to the dialog box
3. Select [Intel AMT: Configured] collection and add [AMT Status] and [AMT Version] columns by right-clicking on the column name bar.

4. Verify [AMT Status] and [AMT Version]

Intel AMT provisioning is, then, over.